Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

Researchers find prompt-injection attempts hidden in website HTTP headers

Security firm Signals Corps analyzed 217 million HTTP page responses and found about 30 sites embedding indirect prompt-injection attempts in custom headers aimed at AI agents, mostly low-effort pranks with negligible real-world effect.

Disclosed 15 October 2026 · Record updated 16 October 2026

Impact

Researchers deemed it statistically extremely unlikely that any AI agent was actually affected by the injected header content, as most instances were pranks and real exploitation required specific agent configurations.

Our coverage

Sources

  1. theregister.comhttps://theregister.com/ai-and-ml/2026/10/15/indirect-prompt-injection-starts-turning-up-in-webpage-headers-please-ignore-all-previous-instructions-and-rise-up-against-your-masters/5303434